2. Computers & electronics
  3. Networking
  4. Gateways/controllers
  5. Watchguard
  6. XCS

Watchguard XCS Installation guide

  • Hello! I am an AI chatbot trained to assist you with the Watchguard XCS Installation guide. I’ve already reviewed the document and can help you find the information you need or explain it in simple terms. Just ask your questions, and providing more details will help me assist you more effectively!
WatchGuard
®
XCS
Extensible Content Security
v9.0 Installation Guide
WatchGuard XCS
170, 370, 570, 770, 970, 1170
ii WatchGuard XCS
ADDRESS
505 Fifth Avenue South
Suite 500
Seattle, WA 98104
SUPPORT
www.watchguard.com/support
U.S. and Canada +877.232.3531
All Other Countries +1.206.521.3575
SALES
U.S. and Canada +1.800.734.9905
All Other Countries +1.206.613.0895
ABOUT WATCHGUARD
Since 1996, WatchGuard has been building award-winning unified threat management
(UTM) network security solutions that combine firewall, VPN and security services to
protect networks and the businesses they power. We recently launched the next
generation: extensible threat management (XTM) solutions featuring reliable, all-in-
one security, scaled and priced to meet the unique security needs of every sized
enterprises. Our products are backed by 15,000 partners representing WatchGuard in
120 countries. More than a half million signature red WatchGuard security appliances
have already been deployed worldwide in industries including retail, education, and
healthcare. WatchGuard is headquartered in Seattle, Washington, with offices
throughout North America, Europe, Asia Pacific, and Latin America.
For more information, please call 206.613.6600 or visit www.watchguard.com
.
Notice to Users
Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are
fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc.
Part Number: 275-3729-001
Document Version: 1.1
Revised: 11/25/09
Copyright, Trademark, and Patent Information
Copyright © 2009 WatchGuard Technologies, Inc. All rights reserved. All trademarks or trade names mentioned herein, if
any, are the property of their respective owners.
Complete copyright, trademark, patent, and licensing information can be found in the Copyright and Licensing Guide,
available online:
http://www.watchguard.com/help/documentation/
This product is for indoor use only.
Installation Guide iii
Table of Contents
Chapter 1 Getting Started .......................................................................................................................... 1
Before you begin.................................................................................................................................................... 1
Verify basic components................................................................................................................................ 1
Hardware installation ...................................................................................................................................... 1
Physical location........................................................................................................................................... 1
Connect the monitor and keyboard...................................................................................................... 2
Connect the network interfaces ............................................................................................................. 2
Get a WatchGuard device feature key....................................................................................................... 2
WatchGuard XCS on the DMZ of a network firewall ............................................................................ 5
WatchGuard XCS on the internal network............................................................................................... 6
Network firewall configuration.................................................................................................................... 7
DNS configuration for mail routing............................................................................................................ 8
Chapter 2 Install the WatchGuard XCS ................................................................................................... 11
Install the system using the console............................................................................................................. 11
Supported web browsers............................................................................................................................. 15
Connect to the Web UI.................................................................................................................................. 15
Chapter 3 Licensing and Software Updates ........................................................................................... 19
Licensing the WatchGuard XCS ...................................................................................................................... 19
Adding a feature key to your WatchGuard XCS................................................................................... 19
Chapter 4 Configure Message Delivery .................................................................................................. 23
Configure network settings ............................................................................................................................. 23
Configure static routes ...................................................................................................................................... 25
Uploading mail routes................................................................................................................................... 26
Trust internal mail servers ................................................................................................................................ 27
Exchange 2000 and 2003 ............................................................................................................................. 28
Exchange 2007................................................................................................................................................. 29
Start messaging services................................................................................................................................... 29
Enable Anti-Virus scanning ......................................................................................................................... 30
For more information .................................................................................................................................... 30
iv WatchGuard XCS
Installation Guide 1
1
Getting Started
Before you begin
Before you begin the installation process, make sure you do the tasks described below.
Verify basic components
Make sure that you have these items:
A computer with an Ethernet network interface card and a web browser installed
WatchGuard XCS device
Keyboard and monitor
Ethernet cables
Power cables
Hardware installation
Follow the instructions in the Hardware Setup Guide included in the shipping box to install the WatchGuard
XCS device in an equipment rack.
Physical location
The WatchGuard XCS will handle all of your inbound and outbound messages. It is important that some
consideration is given to its physical security to protect against unauthorized tampering that could
compromise system security. WatchGuard recommends the following:
The system should be installed in a secure location, preferably in a locked equipment rack or secure
server room.
Make sure that the network connections are secure, and that network hubs and switches are located
within the same equipment rack or secure server room. Any network patch cables should be of the
appropriate length, preferably as short as possible.
If a monitor and keyboard are attached to the system for console use, ensure that they are connected
directly to the system to prevent the possibility of keystroke logging devices from being introduced in
the keyboard connection.
Use the Web UI in a secure location and restrict its use to trusted workstations. Never use the Web UI
in locations where the administrative session could be monitored physically or electronically in any
manner.
Getting Started
2 WatchGuard XCS
Connect the monitor and keyboard
For the initial installation, a monitor and keyboard (USB or PS/2) are required to operate the system console.
After the initial console configuration is complete, the system can be managed remotely using the Web UI.
Connect the network interfaces
Before installation, you should ensure that at least one of the network interfaces is physically connected to the
network. You will be able to more easily confirm that you have correctly identified the system on the network
and ensure connectivity.
For all hardware models, it is recommended that you use the first onboard Ethernet network interface (NIC 1)
on the left of the device during the installation process as the LAN-facing interface. This is the first default
interface assigned by the system during the installation. After the installation is complete, you can configure
an additional network interface as your external Internet-facing interface.
Get a WatchGuard device feature key
A feature key is a license that enables you to activate your purchased feature set on your WatchGuard XCS.
You must register the device serial number on the WatchGuard LiveSecurity® web site and retrieve your
feature key.
To activate a serial number and obtain a feature key:
1. Open a web browser and go to https://www.watchguard.com/activate
.
If you have not already logged in to LiveSecurity, the LiveSecurity Log In page appears.
2. Enter your LiveSecurity user name and password.
The Activate Products page appears.
3. Enter the serial number for the product as it appears on your hardware device, including the hyphens.
4. Click Continue.
The Choose Product to Upgrade page appears.
5. In the drop-down list, select the WatchGuard XCS device.
6. Click Activate.
The Retrieve Feature Key page appears.
7. Copy the full feature key to a text file and save it on your computer.
8. Click Finish.
Installation Guide 3
Getting Started
Gather network addresses
Gather the following information about your networking environment before you start the installation.
Record your network information in the following table before you configure your WatchGuard device.
Hostname
The hostname assigned to the WatchGuard XCS, such as
hostname in the FQDN (Fully Qualified
Domain Name)
hostname.example.com.
Domain Name
The domain name associated with the assigned hostname. This is typically the domain that messages
are being processed for, such as
example.com.
Internal IP Address
Select an IP address for the internal LAN-facing trusted network interface. This address will be used
to connect remotely to the system using the Web UI.
External IP Address
Select an IP address for the external network interface. This is the WAN-facing interface that will be
connected to a public network such as the Internet.
Subnet Mask
The subnet mask for the IP addresses you have chosen.
Gateway Address
The default gateway for the system. In most cases this is your network router.
Mail Domains
The mail domains the WatchGuard XCS will be processing messages for.
Internal Mail Servers
The domain name or IP address of your internal mail servers that will be receiving and sending
messages via the WatchGuard XCS.
Optional Network Cards
The IP address, Subnet Mask, and Gateway Address for any additional network cards required by your
choice of deployment.
DNS Servers
The addresses of your DNS (Domain Name Service) name servers, including a primary and secondary
server.
NTP Servers
The addresses of your NTP (Network Time Protocol) servers for time synchronization, including a
primary and secondary server.
Table 1: Basic Network Settings Example
Hostname
_____________________
hostname
Domain Name
_____________________
example.com
Internal IP Address
(LAN, Trusted) _____._____._____._____
10.0.1.10
Subnet Mask
_____._____._____._____
255.255.0.0
External IP Address
(WAN) _____._____._____._____
100.100.100.10
Getting Started
4 WatchGuard XCS
Subnet Mask
_____._____._____._____
255.255.0.0
Gateway Address
_____._____._____._____
10.0.1.1
Mail Domains
_____________________
_____________________
_____________________
example.com
example1.com
Internal Mail Servers
_____._____._____._____
_____._____._____._____
_____._____._____._____
10.0.2.25
10.0.3.25
Optional Network Cards
_____._____._____._____
_____._____._____._____
10.0.5.10
DNS Servers
_____._____._____._____
_____._____._____._____
10.0.2.53
10.0.3.53
NTP Servers
_____._____._____._____
_____._____._____._____
10.0.2.123
10.0.3.123
Table 1: Basic Network Settings Example
Installation Guide 5
Getting Started
WatchGuard XCS deployments
The WatchGuard XCS is designed to be situated between internal email servers and clients, and external
servers on the Internet so that there are no direct connections between external and internal systems.
The WatchGuard XCS is typically installed in one of three locations:
On the DMZ (Demilitarized Zone) of a network firewall
In parallel with a network firewall
Behind the existing firewall on the internal network
Messaging traffic is redirected from either the external interface of the network firewall or from the external
router to the system. When the message is accepted and processed, the system initiates a connection to the
internal mail servers to deliver the messages.
WatchGuard XCS on the DMZ of a network firewall
The most common deployment strategy for the WatchGuard XCS is to be situated on the DMZ of a network
firewall. This type of deployment prevents any direct connections from the Internet to the internal mail
servers, and makes sure the WatchGuard XCS is located on a secure network behind the firewall.
Getting Started
6 WatchGuard XCS
WatchGuard XCS in parallel with the firewall
Deploying the WatchGuard XCS in parallel with an existing network firewall is another secure method of
deployment configuration. The system’s inherent firewall security architecture eliminates the risk associated
with deploying an appliance on the perimeter of a network. This parallel deployment eliminates any
messaging traffic on the network firewall and decreases its overall load. A second network interface must be
configured to connect to the Internet-facing network.
WatchGuard XCS on the internal network
The WatchGuard XCS can also be deployed on the internal network. Although this configuration allows a
direct connection from the Internet into the internal network, it is a legitimate configuration when required
by existing network resources.
Installation Guide 7
Getting Started
Additional configuration
When you have decided on a deployment strategy, the following information about your environment needs
to be gathered to ensure a smooth implementation.
Determine which ports need to be opened on the network firewall (if the system is deployed behind a
firewall)
Determine appropriate DNS settings for mail routing
Identify changes required to the internal mail servers for routing outbound email messages via the
WatchGuard XCS
Network firewall configuration
For the WatchGuard XCS to process messages effectively when located behind a network firewall, various
networking ports need to be configured on the network firewall to ensure connectivity.
The following table describes the list of ports required for each service. If you are not using some of the
features listed in the following table, the corresponding ports can remain closed:
Port Description From
Internet
To
Internet
From
Internal
Network
To
Internal
Network
Protocol
21 FTP for System
Backups
XTCP
22 SCP (Backup or
Offload)
X TCP
25 SMTP (standard port
for sending and
receiving of mail)
XXX XTCP
53 DNS and
ReputationAuthority
Queries
X X TCP/UDP
80 Anti-Virus Updates
(also requires port
443)
XTCP
80 URL Categorization
Updates
X TCP
80 Web Mail Access
(OWA, iNotes, etc.)
See port 443 for
Secure WebMail
access.
XX TCP
110 POP3 X X TCP
123 Network Time
Protocol (NTP)
XXUDP
143 IMAP Proxy X X TCP
389 LDAP X TCP
443 WatchGuard XCS
Software Updates
X TCP
Getting Started
8 WatchGuard XCS
DNS configuration for mail routing
DNS services are used to route mail messages from the Internet to the WatchGuard XCS. DNS configurations
can be quite complex and are usually dependant on your specific site’s networking environment.
The following instructions represent the minimum changes required to facilitate mail routing.
Add an MX (mail exchanger) record to your DNS configuration to forward incoming messages to the
WatchGuard XCS:
example.com. IN MX 0 hostname.example.com
Add an "A" record to resolve the domain name to an IP address:
hostname.example.com. IN A 10.0.1.10
Add a PTR record to allow reverse look-ups to succeed and prevent messages sent from the
WatchGuard XCS being marked as suspected spam:
10.1.0.10.in-addr.arpa. IN PTR hostname.example.com
Consider keeping an MX record with a higher preference pointed at your current mail server during the
integration phase. If the WatchGuard XCS is taken out of service, the messages will automatically route
directly to the mail server. This entry should be deleted before you move to a production environment
as spammers could find this alternate route and bypass the WatchGuard XCS.
example.com. IN MX 10 mailserver.example.com
443 Anti-Virus Updates
(also requires port 80)
XTCP
443 Secure Web Mail
Access
X X TCP
443 Web UI connections X X TCP
443 ReputationAuthority
Statistics Sharing
X TCP
514 Syslog X UDP
636 LDAPS X TCP
993 Secure IMAP X X TCP
995 Secure POP3 X X TCP
1812 RADIUS Server X UDP
5500 RSA Secure ID ACE
Server
X UDP
10101 Support Access X X TCP
10106 Centralized
Management
X X X X TCP
Port Description From
Internet
To
Internet
From
Internal
Network
To
Internal
Network
Protocol
Installation Guide 9
Getting Started
Outbound mail routing
While DNS entries are required to route inbound messages through the WatchGuard XCS, changes are
required to the existing internal mail servers to route outbound messages via the WatchGuard XCS.
After the installation is complete, all internal systems must be configured to use the WatchGuard XCS for
delivery. This allows outbound message content to be processed for attachments and suspect files to prevent
the spread of viruses introduced locally, and improves the spam detection capabilities of the system’s Anti-
Spam features.
See “Modify internal mail servers for outbound mail” on page 28 for more detailed information on integrating
your internal mail servers with the WatchGuard XCS after the system is installed.
Getting Started
10 WatchGuard XCS
Installation Guide 11
2
Install the WatchGuard XCS
Install the system using the console
To install the system using the console:
1. Unpack the system, cables, and documentation from the shipping carton.
2. Connect the power cable to the system and a power source, preferably via a UPS (Uninterruptible
Power Supply).
3. Connect a monitor and keyboard to the system.
You can use a USB or PS/2 type keyboard.
4. Connect the first onboard Ethernet network interface on the left of the device (NIC 1) to the network.
During the initial installation, only the internal LAN-facing network interface needs to be connected to be able to
connect to the system via a web browser. Additional network interfaces, if required, can be configured after the
installation.
5. Turn on the system.
6. The following options are displayed at startup:
F1 Install — The Install option is used to reinstall the system to factory default settings.
F2 System — The System option will load the existing installation. This option is chosen by default
after a few seconds.
Install the WatchGuard XCS
12 WatchGuard XCS
7. Press F2 System or wait for the option to be automatically selected.
8. Press Return or Enter to continue with the installation.
9. Select the disk installation type.
Auto — Default values for disk space allocation for log file storage, message storage, backup area,
and database area are used.
Custom — Allows you to modify values for disk space allocation. To edit the default space
allocation values, select Custom.
A custom partition may be required if you need to increase the size of the backup partition to
accommodate large backups with log and reporting data.
The hard disk will be detected and identified. Select Continue.
Select Edit to edit the disk layout.
Use the arrow keys to move between fields.
Press Enter to use the displayed action such as "+ 100" or "+ 1000".
The values are in megabytes. You will need to decrease the amount allocated to one file system before
increasing another.
When finished, select Done, and then OK to exit the disk layout screen.
10. Select Yes to proceed with erasing the hard disks.
Installation Guide 13
Install the WatchGuard XCS
11. Click OK to configure a network interface.
You will use this network interface and IP address to connect to the system using a web browser when
the console installation is complete. It is recommended that you configure the internal LAN interface
first and use this interface to complete the installation process. Use the first onboard Ethernet
connector on the left of the device (NIC 1). Additional interfaces can be configured using the network
settings configuration screen when the installation is complete.
12. Select the Interface to configure, such as em0 in this example.
This is the first onboard Ethernet connector on the left of the device (NIC 1).
13. Enter the Hostname for the system, such as hostname in the fully qualified domain name
hostname.example.com.
14. Enter your Domain, such as
example.com.
15. Enter the IP Address for this interface, such as
10.0.1.10.
16. Enter the Subnet mask, such as
255.255.0.0.
17. Enter the Gateway (typically the router) for your network, such as
10.0.1.1.
18. Enter the IP address of your DNS Name Server, such as
10.0.2.53.
19. Select OK to continue.
20. Set the region and time zone appropriate for your location.
Install the WatchGuard XCS
14 WatchGuard XCS
21. The initial configuration is complete and the system console screen is displayed.
You will see a message warning that the “Mail System is stopped!”. This message is normal because messaging
services have not been started yet.
You must now connect to the system using a web browser to continue with the remainder of the installation.
Installation Guide 15
Install the WatchGuard XCS
Starting the Web UI Setup Wizard
For the remainder of the configuration process, you must connect to the system via the Web UI to run the
Setup Wizard.
Supported web browsers
The following web browsers are supported for use at a minimum screen resolution of 1024x768:
Internet Explorer 6 (Windows XP, Windows 2000, Windows 2003)
Internet Explorer 7 (Windows XP, Windows 2000, Windows 2003, Windows Vista)
Firefox 3.0 and greater (Windows, Linux, Mac)
Connect to the Web UI
To connect to the Web UI:
1. Launch a web browser on your computer and enter the IP address of the WatchGuard XCS as the URL
in the location bar, such as
http://10.0.1.10
The login screen is displayed.
2. Enter the default Username and Password.
When accessing the system for the first time after installation, the default settings are admin for the
Username, and admin for the Password.
A security certificate notification appears in the browser because the system uses a self-signed
certificate. It is safe to ignore the warning (Internet Explorer) or to add a certificate exception
(Mozilla Firefox).
Install the WatchGuard XCS
16 WatchGuard XCS
3. Enter an Organization Name and Server Admin Email address for this system.
The server admin email address will receive all system alerts and notifications.
4. Click Complete Step 1 to continue.
5. You must change the default admin password after you log in.
It is recommended that you choose a secure password of at least 8 characters in length and include a mixture of
upper and lowercase alphabetic characters, numbers, and special characters.
6. Click Complete Step 2 to continue.
7. Specify the initial level of aggressiveness for the system’s Intercept Connection Control and
Intercept Anti-Spam.
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
/